build(fdt-wrappers): introduce FDT wrappers makefile

This has been introduced to simplify dependencies on the FDT wrappers.
We generally want to avoid pulling in components on a file-by-file
basis,

build(fdt-wrappers): introduce FDT wrappers makefile

This has been introduced to simplify dependencies on the FDT wrappers.
We generally want to avoid pulling in components on a file-by-file
basis, particularly as we are trying to draw conceptual boxes around
components in preparation for transitioning the build system to CMake,
where dependencies are modelled on libraries rather than files.

Signed-off-by: Chris Kay <chris.kay@arm.com>
Change-Id: Idb7ee05a9b54a8caa3e07f36e608867e20b6dcd5

show more ...

feat(measured_boot): image hash measurement and recording in BL1

It looks safer and cleaner approach to record the measurement taken by
BL1 straightaway in TCG Event Log instead of deferring these r

feat(measured_boot): image hash measurement and recording in BL1

It looks safer and cleaner approach to record the measurement taken by
BL1 straightaway in TCG Event Log instead of deferring these recordings
to BL2.
Hence pull in the full-fledged measured boot driver into BL1 that
replaces the former ad-hoc platform interfaces i.e.
bl1_plat_set_bl2_hash, bl2_plat_get_hash.

As a result of this change the BL1 of Arm FVP platform now do the
measurements and recordings of below images:
1. FW_CONFIG
2. TB_FW_CONFIG
3. BL2

Change-Id: I798c20336308b5e91b547da4f8ed57c24d490731
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

refactor(measured boot): move image measurement to generic layer

Right now, the assumption is that the platform post-load hook takes
care of measuring the image that just got loaded. This is how it'

refactor(measured boot): move image measurement to generic layer

Right now, the assumption is that the platform post-load hook takes
care of measuring the image that just got loaded. This is how it's
implemented on FVP.

This patch moves the measurement into the generic code
instead. load_auth_image() now calls plat_mboot_measure_image(),
which is a new platform interface introduced in this patch to measure
an image. This is called just after authenticating the image.

Implement plat_mboot_measure_image() for the Arm FVP platform. The code
is copied straight from the post-load hook.

As a result, the FVP specific implementation of
arm_bl2_plat_handle_post_image_load() is no longer needed. We can go
back to using the Arm generic implementation of it.

Change-Id: I7b4b8d28941a865e10af9d0eadaf2e4850942090
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

refactor(hw_crc32): renamed hw_crc32 to tf_crc32

Renamed hw_crc32 to tf_crc32 to make the file and function
name more generic so that the same name can be used in upcoming
software CRC32 implementat

refactor(hw_crc32): renamed hw_crc32 to tf_crc32

Renamed hw_crc32 to tf_crc32 to make the file and function
name more generic so that the same name can be used in upcoming
software CRC32 implementation.

Change-Id: Idff8f70c50ca700a4328a27b49d5e1f14d2095eb
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

feat(fwu): avoid booting with an alternate boot source

All firmware banks should be part of the same non-volatile storage
as per PSA FWU specification, hence avoid checking for any alternate
boot so

feat(fwu): avoid booting with an alternate boot source

All firmware banks should be part of the same non-volatile storage
as per PSA FWU specification, hence avoid checking for any alternate
boot source when PSA FWU is enabled.

Change-Id: I5b016e59e87f1cbfc73f4cd29fce6017c24f88b3
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

Merge changes Ic7579b60,I05414ca1 into integration

* changes:
fix(plat/ea_handler): print newline before fatal abort error message
feat(common/debug): add new macro ERROR_NL() to print just a ne

Merge changes Ic7579b60,I05414ca1 into integration

* changes:
fix(plat/ea_handler): print newline before fatal abort error message
feat(common/debug): add new macro ERROR_NL() to print just a newline

show more ...

fix(fdt): fix OOB write in uuid parsing function

The function read_uuid() zeroes the UUID destination buffer
on error. However, it mistakenly uses the dest pointer
that has been incremented many tim

fix(fdt): fix OOB write in uuid parsing function

The function read_uuid() zeroes the UUID destination buffer
on error. However, it mistakenly uses the dest pointer
that has been incremented many times during the parsing,
leading to an out-of-bounds write.

To fix this, retain a pointer to the start of the buffer,
and use this when clearing it instead.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
Change-Id: Iee8857be5d3f383ca2eab86cde99a43bf606f306

show more ...

feat(common/debug): add new macro ERROR_NL() to print just a newline

Existing macro ERROR() prints string "ERROR" followed by string
specified by caller. Therefore via this existing macro it is not

feat(common/debug): add new macro ERROR_NL() to print just a newline

Existing macro ERROR() prints string "ERROR" followed by string
specified by caller. Therefore via this existing macro it is not
possible to end incomplete / existing line by a newline character.

This change adds a new macro ERROR_NL() which prints just a newline
character without any prefix. Implementation of this macro is done via a
new function tf_log_newline() which based on supplied log level either
return or print newline character.

If needed in future based on this tf_log_newline() function can be
defined also macros for other log levels.

Signed-off-by: Pali Rohár <pali@kernel.org>
Change-Id: I05414ca177f94cdc0f6077394d9c4af4a4382306

show more ...

feat(hw_crc): add support for HW computed CRC

Added support for HW computed CRC using Arm ACLE intrinsics.
These are built-in intrinsics available for ARMv8.1-A, and
onwards.
These intrinsics are en

feat(hw_crc): add support for HW computed CRC

Added support for HW computed CRC using Arm ACLE intrinsics.
These are built-in intrinsics available for ARMv8.1-A, and
onwards.
These intrinsics are enabled via '-march=armv8-a+crc' compile
switch for ARMv8-A (supports CRC instructions optionally).

HW CRC support is enabled unconditionally in BL2 for all Arm
platforms.

HW CRC calculation is verified offline to ensure a similar
result as its respective ZLib utility function.

HW CRC calculation support will be used in the upcoming
firmware update patches.

Change-Id: Ia2ae801f62d2003e89a9c3e6d77469b5312614b3
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

feat(fdt): introduce wrapper function to read DT UUIDs

TF-A does not have the capability to read UUIDs in string form
from the device tree. This capability is useful for readability,
so add a wrappe

feat(fdt): introduce wrapper function to read DT UUIDs

TF-A does not have the capability to read UUIDs in string form
from the device tree. This capability is useful for readability,
so add a wrapper function, fdtw_read_uuid() to parse UUIDs from
the DT.
This function should parse a string of the form:

"aabbccdd-eeff-4099-8877-665544332211"

to the byte sequence in memory:

[aa bb cc dd ee ff 40 99 88 77 66 55 44 33 22 11]

Change-Id: I99a92fbeb40f4f4713f3458b36cb3863354d2bdf
Signed-off-by: David Horstmann <david.horstmann@arm.com>

show more ...

fdt: Use proper #address-cells and #size-cells for reserved-memory

The devicetree binding document[1] for the /reserved-memory node demands
that the number of address and size-cells in the reserved-

fdt: Use proper #address-cells and #size-cells for reserved-memory

The devicetree binding document[1] for the /reserved-memory node demands
that the number of address and size-cells in the reserved-memory node
must match those values in the root node. So far we were forcing a
64-bit address along with a 32-bit size.

Adjust the code to query the cells values from the root node, and
populate the newly created /reserved-memory node accordingly.

This fixes the fdt_add_reserved_memory() function when called on a
devicetree which does not use the 2/1 pair. Linux is picky about this
and will bail out the parsing routine, effectively ignoring the
reserved-memory node:
[ 0.000000] OF: fdt: Reserved memory: unsupported node format, ignoring

[1] Documentation/devicetree/bindings/reserved-memory/reserved-memory.txt
in the Linux kernel source tree

Change-Id: Ie126ebab4f3fedd48e12c9ed4bd8fa123acc86d3
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

Print newline after hex address in aarch64 el3_panic function

Make the aarch64's el3_panic() function print a newline character after
PC address, otherwise the output can get mangled in one line wit

Print newline after hex address in aarch64 el3_panic function

Make the aarch64's el3_panic() function print a newline character after
PC address, otherwise the output can get mangled in one line with output
from other firmware. Here is an example of how the output of el3_panic()
got mangled with Linux' console output:

ERROR: Unhandled External Abort received on 0x80000001 at EL3!
ERROR: exception reason=1 syndrome=0x92000210
PANIC at PC : 0x0000000004027400[13438.473133] rcu: INFO: rcu_sched detected stalls on CPUs/tasks:
[13438.479255] rcu: 1-...0: (4 ticks this GP) idle=35e/1/0x4000000000000000 softirq=146459/146459 fqs=2625

The aarch32 version of this function already does this.

Signed-off-by: Pali Rohár <pali@kernel.org>
Change-Id: I9f0d032c6cd1e2be7a1837f9c8e8244d30633993

show more ...

Merge "Increase type widths to satisfy width requirements" into integration

Increase type widths to satisfy width requirements

Usually, C has no problem up-converting types to larger bit sizes. MISRA
rule 10.7 requires that you not do this, or be very explicit about this.
T

Increase type widths to satisfy width requirements

Usually, C has no problem up-converting types to larger bit sizes. MISRA
rule 10.7 requires that you not do this, or be very explicit about this.
This resolves the following required rule:

bl1/aarch64/bl1_context_mgmt.c:81:[MISRA C-2012 Rule 10.7 (required)]<None>
The width of the composite expression "0U | ((mode & 3U) << 2U) | 1U |
0x3c0U" (32 bits) is less that the right hand operand
"18446744073709547519ULL" (64 bits).

This also resolves MISRA defects such as:

bl2/aarch64/bl2arch_setup.c:18:[MISRA C-2012 Rule 12.2 (required)]
In the expression "3U << 20", shifting more than 7 bits, the number
of bits in the essential type of the left expression, "3U", is
not allowed.

Further, MISRA requires that all shifts don't overflow. The definition of
PAGE_SIZE was (1U << 12), and 1U is 8 bits. This caused about 50 issues.
This fixes the violation by changing the definition to 1UL << 12. Since
this uses 32bits, it should not create any issues for aarch32.

This patch also contains a fix for a build failure in the sun50i_a64
platform. Specifically, these misra fixes removed a single and
instruction,

92407e73 and x19, x19, #0xffffffff

from the cm_setup_context function caused a relocation in
psci_cpus_on_start to require a linker-generated stub. This increased the
size of the .text section and caused an alignment later on to go over a
page boundary and round up to the end of RAM before placing the .data
section. This sectionn is of non-zero size and therefore causes a link
error.

The fix included in this reorders the functions during link time
without changing their ording with respect to alignment.

Change-Id: I76b4b662c3d262296728a8b9aab7a33b02087f16
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

show more ...

Don't return error information from console_flush

And from crash_console_flush.

We ignore the error information return by console_flush in _every_
place where we call it, and casting the return typ

Don't return error information from console_flush

And from crash_console_flush.

We ignore the error information return by console_flush in _every_
place where we call it, and casting the return type to void does not
work around the MISRA violation that this causes. Instead, we collect
the error information from the driver (to avoid changing that API), and
don't return it to the caller.

Change-Id: I1e35afe01764d5c8f0efd04f8949d333ffb688c1
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

show more ...

fdt: Fix coverity complaint about 32-bit multiplication

Coverity raised an eyebrow over our GICR frame size calculation:
========
CID 362942: Integer handling issues (OVERFLOW_BEFORE_WIDEN)
Po

fdt: Fix coverity complaint about 32-bit multiplication

Coverity raised an eyebrow over our GICR frame size calculation:
========
CID 362942: Integer handling issues (OVERFLOW_BEFORE_WIDEN)
Potentially overflowing expression "nr_cores * gicr_frame_size" with type
"unsigned int" (32 bits, unsigned) is evaluated using 32-bit arithmetic,
and then used in a context that expects an expression of type "uint64_t"
(64 bits, unsigned).
========

Even with a GICv4 (256KB frame size) we need 16384 cores to overflow
32-bit, so it's not a practical issue.

But it's also easy to fix, so let's just do that: cast gicr_frame_size
to an unsigned 64-bit integer, so that the multiplication is done in the
64-bit realm.

Change-Id: Iad10e19b9e58d5fbf9d13205fbcef0aac5ae48af
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

Merge changes from topic "stm32_exceptions" into integration

* changes:
stm32mp1: correct crash console GPIO alternate configuration
stm32mp1: add plat_panic_handler function
stm32mp1: update

Merge changes from topic "stm32_exceptions" into integration

* changes:
stm32mp1: correct crash console GPIO alternate configuration
stm32mp1: add plat_panic_handler function
stm32mp1: update plat_report_exception
Align AARCH32 version of debug.S with AARCH64

show more ...

fdt: Add function to adjust GICv3 redistributor size

We now have code to detect the CPU topology at runtime, and can also
populate the CPU nodes in a devicetree accordingly. This is used by the
ARM

fdt: Add function to adjust GICv3 redistributor size

We now have code to detect the CPU topology at runtime, and can also
populate the CPU nodes in a devicetree accordingly. This is used by the
ARM FPGA port, for instance.
But also a GICv3 compatible interrupt controller provides MMIO frames
per core, so the size of this region needs to be adjusted in the DT,
to match the number of cores as well.

Provide a generic function to find the GICv3 interrupt controller in
the DT, then adjust the "reg" entry to match the number of detected
cores. Since the size of the GICR frame per cores differs between
GICv4 and GICv3, this size is supplied as a parameter to the function.
The caller should determine the applicable value by either hardcoding
it or by observing GICR_TYPER.VLPIS.

Change-Id: Ic2a6445c2c5381a36bf24263f52fcbefad378c05
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

Align AARCH32 version of debug.S with AARCH64

Re-order code (put panic and report_exception at the end of the file).
Export asm_print_* functions.
Add asm_print_line_dec macro, and asm_print_newline

Align AARCH32 version of debug.S with AARCH64

Re-order code (put panic and report_exception at the end of the file).
Export asm_print_* functions.
Add asm_print_line_dec macro, and asm_print_newline func.
Align comments in both AARCH32 and AARCH64 files.
Add blank lines in AARCH64 files to align with AARCH32.

Change-Id: I8e299a27c1390f71f04e260cd4a0e59b2384eb19
Signed-off-by: Yann Gautier <yann.gautier@st.com>

show more ...

Add support to export a /cpus node to the device tree.

This patch creates and populates the /cpus node in a device tree
based on the existing topology. It uses the minimum required nodes
and propert

Add support to export a /cpus node to the device tree.

This patch creates and populates the /cpus node in a device tree
based on the existing topology. It uses the minimum required nodes
and properties to satisfy the binding as specified in
https://www.kernel.org/doc/Documentation/devicetree/bindings/arm/cpus.txt

Signed-off-by: Javier Almansa Sobrino <javier.almansasobrino@arm.com>
Change-Id: I03bf4e9a6427da0a3b8ed013f93d7bc43b5c4df0

show more ...

Add wrapper for AT instruction

In case of AT speculative workaround applied, page table walk
is disabled for lower ELs (EL1 and EL0) in EL3.
Hence added a wrapper function which temporarily enables

Add wrapper for AT instruction

In case of AT speculative workaround applied, page table walk
is disabled for lower ELs (EL1 and EL0) in EL3.
Hence added a wrapper function which temporarily enables page
table walk to execute AT instruction for lower ELs and then
disables page table walk.

Execute AT instructions directly for lower ELs (EL1 and EL0)
assuming page table walk is enabled always when AT speculative
workaround is not applied.

Change-Id: I4ad4c0bcbb761448af257e9f72ae979473c0dde8
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

plat/fvp: Support for extracting UART serial node info from DT

This patch introduces the populate function which leverages
a new driver to extract base address and clk frequency properties
of the ua

plat/fvp: Support for extracting UART serial node info from DT

This patch introduces the populate function which leverages
a new driver to extract base address and clk frequency properties
of the uart serial node from HW_CONFIG device tree.

This patch also introduces fdt helper API fdtw_translate_address()
which helps in performing address translation.

Change-Id: I053628065ebddbde0c9cb3aa93d838619f502ee3
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

SPMD: extract SPMC DTB header size from SPMD

Currently BL2 passes TOS_FW_CONFIG address and size through registers to
BL31. This corresponds to SPMC manifest load address and size. The SPMC
manifest

SPMD: extract SPMC DTB header size from SPMD

Currently BL2 passes TOS_FW_CONFIG address and size through registers to
BL31. This corresponds to SPMC manifest load address and size. The SPMC
manifest is mapped in BL31 by dynamic mapping. This patch removes BL2
changes from generic code (which were enclosed by SPD=spmd) and retrieves
SPMC manifest size directly from within SPMD. The SPMC manifest load
address is still passed through a register by generic code.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I35c5abd95c616ae25677302f0b1d0c45c51c042f

show more ...

fdt/wrappers: Introduce code to find UART DT node

The stdout-path property in the /chosen node of a DTB points to a device
node, which is used for boot console output.
On most (if not all) ARM based

fdt/wrappers: Introduce code to find UART DT node

The stdout-path property in the /chosen node of a DTB points to a device
node, which is used for boot console output.
On most (if not all) ARM based platforms this is the debug UART.
The ST platform code contains a function to parse this property and
chase down eventual aliases to learn the node offset of this UART node.

Introduce a slightly more generalised version of this ST platform function
in the generic fdt_wrappers code. This will be useful for other platforms
as well.

Change-Id: Ie6da47ace7833861b5e35fe8cba49835db3659a5
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

plat/stm32: Use generic fdt_get_reg_props_by_name()

The STM32 platform port parse DT nodes to find base address to
peripherals. It does this by using its own implementation, even though
this functio